SQL Injection Vulnerability in Page and Post Clone Plugin for WordPress
CVE-2026-2893

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Fast Page & Post Duplicator
Vendor
CVE Published:
5 March 2026

What is CVE-2026-2893?

The Page and Post Clone plugin for WordPress suffers from a SQL Injection vulnerability through the 'meta_key' parameter within the content_clone() function. This issue arises due to inadequate escaping of user-supplied values and poor handling of SQL queries in versions up to 6.3. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject malicious SQL commands. The attack allows for second-order injection where the payload is stored as a post meta key and executed upon cloning, enabling potential retrieval of sensitive database information.

Affected Version(s)

Fast Page & Post Duplicator 0 <= 6.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/page-or-post-c...
https://plugins.trac.wordpress.org/browser/page-or-post-c...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arthur GRIMAULT
.